Azure portal URL safelist
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-management-docs · commit 9c6bbc5 · +65 −3 lines · also on GitHub
11
---
22
title: Allow the Azure portal URLs on your firewall or proxy server
33
description: To optimize connectivity between your network and the Azure portal and its services, we recommend you add these URLs to your allowlist.
4
−ms.date: 07/12/2024
4
+ms.date: 01/27/2025
55
ms.topic: conceptual
66
---
77
⋯ 4 unchanged lines
1212
Network administrators often deploy proxy servers, firewalls, or other devices, which can help secure and give control over how users access the internet. Rules designed to protect users can sometimes block or slow down legitimate business-related internet traffic. This traffic includes communications between you and Azure over the URLs listed here.
1313
1414
> [!TIP]
15
−> For help diagnosing issues with network connections to these domains, check https://portal.azure.com/selfhelp.
15
+> For help diagnosing issues with network connections to these domains, visit [Self-diagnostics](https://portal.azure.com/selfhelp).
1616
1717
You can use [service tags](/azure/virtual-network/service-tags-overview) to define network access controls on [network security groups](/azure/virtual-network/network-security-groups-overview), [Azure Firewall](/azure/firewall/service-tags), and user-defined routes. Use service tags in place of fully qualified domain names (FQDNs) or specific IP addresses when you create security rules and routes.
1818
⋯ 12 unchanged lines
3131
> The service tags required to access the Azure portal (including authentication and resource listing) are **AzureActiveDirectory**, **AzureResourceManager**, **AzureFrontDoor.Frontend**, and **AzureFrontDoor.FirstParty**. Access to other services may require additional permissions, as described below.
3232
> However, there is a possibility that unnecessary communication other than communication to access the portal may also be allowed. If granular control is required, FQDN-based access control such as Azure Firewall is required.
3333
34
−#### Azure portal authentication
34
+<!-- #### Azure portal authentication
3535
3636
```
37
+*.auth.microsoft.com
38
+*.msftidentity.com
39
+*.msidentity.com
40
+account.activedirectory.windowsazure.com
41
+accounts.accesscontrol.windows.net
42
+adminwebservice.microsoftonline.com
43
+api.passwordreset.microsoftonline.com
44
+autologon.microsoftazuread-sso.combecws
45
+.microsoftonline.com
46
+ccs.login.microsoftonline.com
47
+clientconfig.microsoftonline-p.net
48
+companymanager.microsoftonline.com
49
+device.login.microsoftonline.com
50
+graph.microsoft.com
51
+graph.windows.net
52
+login-us.microsoftonline.com
53
+login.microsoft.com
54
+login.microsoftonline-p.com
3755
login.microsoftonline.com
56
+login.windows.net
57
+logincert.microsoftonline.com
58
+loginex.microsoftonline.com
59
+nexus.microsoftonline-p.com
60
+passwordreset.microsoftonline.com
61
+provisioningapi.microsoftonline.com
62
+*.hip.live.com
63
+*.microsoftonline-p.com
64
+*.microsoftonline.com
65
+*.msauth.net
66
+*.msauthimages.net
67
+*.msecnd.net
68
+*.msftauth.net
69
+*.msftauthimages.net
70
+*.phonefactor.net
71
+enterpriseregistration.windows.net
72
+policykeyservice.dc.ad.msft.net
73
+account.live.com
74
+login.live.com
75
+20.20.32.0/19
76
+20.190.128.0/18
77
+20.231.128.0/19
78
+40.126.0.0/18
79
+2603:1006:2000::/48
80
+2603:1007:200::/48
81
+2603:1016:1400::/48
82
+2603:1017::/48
83
+2603:1026:3000::/48
84
+2603:1027:1::/48
85
+2603:1036:3000::/48
86
+2603:1037:1::/48
87
+2603:1046:2000::/48
88
+2603:1047:1::/48
89
+2603:1056:2000::/48
90
+2603:1057:2::/48
91
+```
92
+-->
93
+
94
+#### Azure portal authentication
95
+```
96
+login.microsoftonline.com
3897
*.aadcdn.msftauth.net
3998
*.aadcdn.msftauthimages.net
4099
*.aadcdn.msauthimages.net
⋯ 3 unchanged lines
44103
*.aadcdn.microsoftonline-p.com
45104
*.microsoftonline-p.com
46105
```
106
+
107
+> [!IMPORTANT]
108
+> Depending on your environment, you may need to allow additional URLs related to authentication, such as those listed in sections 56, 59, and 97 of [Microsoft 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
47109
48110
#### Azure portal framework
49111
⋯ 124 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-management-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.